Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Fund Over-allocation Vulnerability in Treasury contract

0xblackadam

Description

The allocateFunds function in the Treasury contract allows allocators to allocate amounts exceeding the current treasury balance. There is no validation to ensure that allocated amounts are within available funds, which could lead to over-allocation and potential fund distribution issues.

Vulnerable code:

function allocateFunds(
address recipient,
uint256 amount
) external override onlyRole(ALLOCATOR_ROLE) {
if (recipient == address(0)) revert InvalidRecipient();
if (amount == 0) revert InvalidAmount();
_allocations[msg.sender][recipient] = amount;
emit FundsAllocated(recipient, amount);
}

Impact

  • Allocators can allocate more funds than available in treasury

  • Multiple allocators could collectively over-allocate funds

  • No tracking of total allocated vs available funds

  • Could lead to failed withdrawals

  • Potential for "bank run" scenarios where not all allocations can be fulfilled

Fix Recommendations

  1. Add balance validation:

contract Treasury {
mapping(address => uint256) private _totalAllocated; // Track allocations per token
function allocateFunds(
address token,
address recipient,
uint256 amount
) external onlyRole(ALLOCATOR_ROLE) {
if (recipient == address(0)) revert InvalidRecipient();
if (amount == 0) revert InvalidAmount();
uint256 currentBalance = _balances[token];
uint256 newTotalAllocated = _totalAllocated[token] -
_allocations[msg.sender][recipient] + amount;
if (newTotalAllocated > currentBalance) {
revert InsufficientFundsForAllocation();
}
_totalAllocated[token] = newTotalAllocated;
_allocations[msg.sender][recipient] = amount;
emit FundsAllocated(token, recipient, amount);
}
}

Tools Used

  • Manual code review

  • Foundry Testing Framework

  • Static analysis

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Treasury::allocateFunds doesn't say what token you are actually allocating, doesn't check balances, or existing allocations to other recipients

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.